Data Principal
The individual the personal data is about. For a child or a person with a disability, the parent or lawful guardian acts for them.
Example: A customer, patient, employee or website visitor.
The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first dedicated law on digital personal data. It applies to any business that collects or uses the personal data of people in India, whether you are a startup, a hospital, a bank or an online store. It also covers businesses outside India that offer goods or services to people in India. The law gives individuals clear rights over their data and puts clear duties on you: explain why you collect data, take valid consent, keep data secure, report breaches and erase data once its purpose is over.
The Act speaks in a few defined terms. Knowing who is who tells you which duties are yours and which belong to your vendors.
The individual the personal data is about. For a child or a person with a disability, the parent or lawful guardian acts for them.
Example: A customer, patient, employee or website visitor.Any person or organisation that decides why and how personal data is processed. It carries the main legal duties under the Act.
Example: Your company, clinic, school or app.Anyone who processes personal data on behalf of a Data Fiduciary. The Fiduciary must bind it by contract.
Example: A cloud host, payroll vendor or call centre.A person registered with the Board who gives individuals one place to give, review, manage and withdraw consent.
Example: A registered consent platform.A Data Fiduciary the Government notifies because of the volume or sensitivity of its data and the risk to people.
Example: A large bank, hospital network or digital platform.The body that receives complaints and breach reports, holds inquiries, directs remedial action and imposes penalties.
Example: The regulator you may answer to.Personal data and consent flow from the individual to the organisation that uses it. The Data Protection Board watches over the whole chain.
The law asks your business to get six things right. Each box below explains the rule in simple words and what you can do about it.
Before you take anyone’s data, tell them in simple words what you collect, why you need it and how they can complain. Use English or any Indian language they understand.
What to do: Update your privacy notice wherever you collect data.Get a clear “yes” before using someone’s data, and use it only for the reason you gave. They must be able to say no, or take their “yes” back, easily. A few cases, like a medical emergency, do not need consent.
What to do: Keep a record of consent and a simple way to withdraw it.Keep personal data safe with basics like encryption, strong access control and backups. Make sure the vendors who handle your data do the same.
What to do: Check your security controls and vendor contracts.If personal data is leaked or stolen, you must tell the Data Protection Board and the people affected.
What to do: Make a plan for who does what when a breach happens.If the person is under 18, you need a parent’s or guardian’s permission. Do not track children or show them targeted ads.
What to do: Add age checks and parent approval where needed.People can ask what data you hold, ask you to correct or delete it, and complain to you first. You must be ready to respond.
What to do: Set up a way to take requests and complaints, with a clear reply time.Every DPDP decision comes back to three questions: what must we do, what can people ask of us, and what happens if we get it wrong.
What you must do
What people can ask for
What you face if you fall short
Our audit checks how well your business follows the DPDP Act, shows you where you fall short, and gives you a simple plan to close the gaps. Book your DPDP Readiness Audit to get started.
Book your DPDP audit →
We start by talking with your people and reading your documents, so we see how personal data is really handled right now.
We trace each form, app, vendor and database that touches personal data and bring it all together in a single view.
We compare what you do with what the DPDP Act, 2023 and the DPDP Rules expect from a Data Fiduciary, one requirement at a time.
We score every gap on how likely it is and how damaging it could be, so urgent problems stand apart from minor ones.
You receive a prioritised list of actions, so your team knows what to fix first and exactly how to do it.
All results come together in a single report that shows your status today and a plan for moving forward.
Book your DPDP Readiness Audit and get a clear plan for what to fix first.
Reach Out on WhatsApp →Penalty limits are taken from the Schedule to the Digital Personal Data Protection Act, 2023. This page gives general educational information. It is not legal advice and does not guarantee compliance. Verify provisions, commencement dates and applicability against current official publications.